scan-redactor — Claude Code subagent for report cleanup
This Claude Security subagent replaces secret values in completed scan reports with [REDACTED]. Scan jobs dispatch it automatically; it is not for direct invocation.
/plugin install claude-security@claude-plugins-officialWhat scan-redactor does
scan-redactor checks the three files produced by a completed Claude Security scan: CLAUDE-SECURITY-RESULTS.jsonl, CLAUDE-SECURITY-RESULTS.sarif and CLAUDE-SECURITY-RESULTS.md. It replaces password, key, token and other secret values with [REDACTED]. Variable names and placeholders such as ${API_KEY} stay unchanged.
The subagent uses Read and Edit to inspect and change the reports. Long files are read in pieces, and all three files are checked. It avoids JSON keys and the file, uri and symbol fields, and it creates no files. Check that the scan job supplied the expected three files from one directory: a different set of paths means it makes no edits. Direct invocation is not supported.
What it helps with
- redact secrets in a security scan report
- remove key and token values from JSONL and SARIF files
- mask a password in a URL or user:password pair
- check all report files for remaining secret values
Example prompts for the agent
- Run Claude Security and redact secrets in the resulting report files.
- After the scan, replace password and key values with
[REDACTED]. - Check the Claude Security reports and report any file that could not be cleaned.
How to install scan-redactor
1Plugin marketplace
/plugin install claude-security@claude-plugins-official2Manually: put the files in place
.claude/agents/scan-redactor.mdFor all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention
Manually: put the files in place
.codex/agents/scan-redactor.tomlCodex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/
Manually: put the files in place
.cursor/agents/scan-redactor.mdCursor also reads .claude/agents/
Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean
Questions about scan-redactor
How do I install scan-redactor in Claude Code?
Run /plugin install claude-security@claude-plugins-official, then use .claude/agents/scan-redactor.md.
What does scan-redactor do?
It replaces secret values with [REDACTED] in the three Claude Security report files. It leaves variables and path or identifier fields untouched.
Can I invoke scan-redactor directly?
No. Claude Security scan jobs dispatch it to clean that scan's report files.
